Home / server / Questions / 632217
Accepted
jcollum
Asked: 2014-09-30 12:22:21 +0800 CST

in Server 2012 Group Policy how can I force all users to have password-locked screen savers?

  • 772

This is how I have it configured:

This is how I have it configured. Some users have their screen savers password protected, other's don't. I made the change a week ago, plenty of time for the policy to propagate. Is it possible some of the users in the domain aren't configured to get policy updates?

While only some users have the password lock, all users are currently not able to edit their screen saver.

This is the first time I've ever done anything with group policy. The Domain Controller is Server 2012. The machines are Windows 7.

Edit: looks like it may be a bug in Server 2012: http://support2.microsoft.com/kb/2976965#appliesto, investigating...

windows-server-2012

2 Answers

  1. Best Answer

    Your screenshot isn't showing that you've linked that GPO anywhere.

    Without linking the GPO to an OU it won't actually apply to computers or users.

    I think some background on Group Policy would probably help you out a lot.

    Edit:

    Running the Resultant Set of Policy (RSoP) tool on a user where you hypothesize that your GPO settings are "taking" will show you if they really are. If the GPO isn't linked anywhere then you won't see it in an RSoP output.

    In the case of this setting, which is a user setting, you'll want to link it at or above the OU where your user accounts are located. You could link this particular GPO to the top of the domain with no ill effects.

    • 2

  2. @BradBouchard yes, it's linked in the [CompanyName]Users organization unit. Just didn't expand that in the screenshot. – jcollum 5 mins ago

    If that is, in fact, true, then you'll need to run some GP testing tools both server side and potentially client side. There are two tools at the bottom of your screenshot that are located on the left-hand side of the screen called "Group Policy Modeling" and "Group Policy Results". These tools will help you determine what, theoretically, will happen given a computer/users location/membership, and what actually is being applied. Run them, starting with Group Policy Modeling followed by Group Policy Results to see what should happen to your users, and then you'll find out why things aren't happening as you predict. Also, Scope will be a big factor here. Have you left the Scope set to "Authenticated Users"? If not, then do so, as any filtering of the Scope may cause some of your users to not obtain the settings from this GPO.

    • 2